Make public catalog only enabled via a feature flag

config.py

@@ -263,6 +263,10 @@ class DefaultConfig(ImmutableConfig):
   # Feature Flag: Whether to enable support for App repositories.
   FEATURE_APP_REGISTRY = False
 
+  # Feature Flag: If set to true, the _catalog endpoint returns public repositories. Otherwise,
+  # only private repositories can be returned.
+  FEATURE_PUBLIC_CATALOG = False
+
   # The namespaces which should have the ability to enable signing
   SIGNING_NAMESPACE_WHITELIST = ['coreos', 'quay']
 

endpoints/v2/catalog.py

@@ -1,3 +1,5 @@
+import features
+
 from flask import jsonify
 
 from auth.registry_jwt_auth import process_registry_jwt_auth, get_granted_entity
@@ -15,8 +17,9 @@ def catalog_search(limit, offset, pagination_callback):
   if entity:
     username = entity.user.username
 
+  include_public = bool(features.PUBLIC_CATALOG)
   visible_repositories = model.get_visible_repositories(username, limit+1, offset,
-                                                        include_public=True)
+                                                        include_public=include_public)
   response = jsonify({
     'repositories': ['%s/%s' % (repo.namespace_name, repo.name)
                      for repo in visible_repositories][0:limit],

test/registry_tests.py

@@ -1802,8 +1802,24 @@ class V2RegistryTests(V2RegistryPullMixin, V2RegistryPushMixin, RegistryTestsMix
   def test_one_five_blacklist(self):
     self.conduct('GET', '/v2/', expected_code=404, user_agent='Go 1.1 package http')
 
-  def test_catalog(self):
+  def test_normal_catalog(self):
     # Look for public repositories and ensure all are public.
+    with TestFeature(self, 'PUBLIC_CATALOG', False):
+      response = self.conduct('GET', '/v2/_catalog')
+      data = response.json()
+      self.assertTrue(len(data['repositories']) == 0)
+
+      # Perform auth and lookup the catalog again.
+      self.do_auth('devtable', 'password', 'devtable', 'simple')
+      all_repos = []
+
+      response = self.conduct('GET', '/v2/_catalog', params=dict(n=2), auth='jwt')
+      data = response.json()
+      self.assertEquals(len(data['repositories']), 2)
+
+  def test_public_catalog(self):
+    # Look for public repositories and ensure all are public.
+    with TestFeature(self, 'PUBLIC_CATALOG', True):
       response = self.conduct('GET', '/v2/_catalog')
       data = response.json()
       self.assertTrue(len(data['repositories']) > 0)